Database
WordPress Vulnerability Database (page 75)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.1Multi-Purpose Business WordPress & WooCommerce Theme + ChatGPT <= 3.6.1 - Unauthenticated PHP Object Injection
Qwery - Multi-Purpose Business WordPress & WooCommerce Theme + ChatGPT
≤3.6.1No patch available
- High8.1Intranet, Extranet, Community and BuddyPress WordPress Theme <= 1.5.3 - Unauthenticated PHP Object Injection
Anesta - Intranet, Extranet, Community and BuddyPress WordPress Theme
≤1.5.3No patch available
- High8.1Publishing House, Bookshop & BookStore WordPress Theme + RTL <= 2.13.0 - Unauthenticated PHP Object Injection
Booklovers - Publishing House, Bookshop & BookStore WordPress Theme + RTL
≤2.13.0No patch available
- High8.1Unauthenticated PHP Object Injection
Drone Media | Aerial Photography & Videography Theme
≤2.2.0No patch available
- High8.1Unauthenticated PHP Object Injection
Gutentype | 100% Gutenberg Blog Theme + Elementor
≤2.1.12No patch available
- High8.1Unauthenticated PHP Object Injection
Camelia | Floral Studio Florist WordPress Theme
≤1.2.15No patch available
- High8.1Architecture & Interior Design WordPress Theme <= 1.16.0 - Unauthenticated PHP Object Injection
Convex - Architecture & Interior Design WordPress Theme
≤1.16.0No patch available
- High8.1Building, Construction & Renovation Theme <= 1.16.0 - Unauthenticated PHP Object Injection
Dwell - Building, Construction & Renovation Theme
≤1.16.0No patch available
- High8.1Unauthenticated PHP Object Injection
Edema | Wellness & Spa WordPress Theme
≤1.2.2.2No patch available
- High8.1Electric Car Dealership WordPress Theme <= 2.10.0 - Unauthenticated PHP Object Injection
Greeny - Electric Car Dealership WordPress Theme
≤2.10.0No patch available
- High8.1Unauthenticated PHP Object Injection
Hogwords | School, University Education WordPress Theme
≤1.2.7No patch available
- High8.1Cleaning Services WordPress Theme <= 1.21.0 - Unauthenticated PHP Object Injection
Hygia - Cleaning Services WordPress Theme
≤1.21.0No patch available
- High8.1Online Pharmacy Woocommerce Elementor Template Kit <= 1.2.4 - Unauthenticated PHP Object Injection
iPharm - Online Pharmacy Woocommerce Elementor Template Kit
≤1.2.4No patch available
- High8.1Unauthenticated PHP Object Injection
Let's Play | Hockey School & Winter Sports WordPress Theme
≤1.1.15No patch available
- High8.1Unauthenticated PHP Object Injection
Partiso | Political Party & Candidate Elementor Template Kit
≤1.1.13No patch available
- High8.1Unauthenticated PHP Object Injection
Rosalinda | Health Coach & Vegetarian Lifestyle WordPress Theme
≤1.2.4No patch available
- High8.1Unauthenticated PHP Object Injection
Smart Casa | Home Automation & House Technologies WordPress Theme
≤1.0.12No patch available
- High8.1Tennis WordPress Theme <= 1.12.0 - Unauthenticated PHP Object Injection
Smash - Tennis WordPress Theme
≤1.12.0No patch available
- High8.1Unauthenticated PHP Object Injection
Tantra | Yoga Studio and Fitness Club WordPress Theme
≤2.9.0No patch available
- High8.1Unauthenticated PHP Object Injection
Travesia | Travel Agency and Tour Booking WordPress Theme
≤1.1.16No patch available
- High8.1Unauthenticated PHP Object Injection
Buzz Stone | Magazine & Viral Blog WordPress Theme
≤1.0.2No patch available
- High8.1Unauthenticated PHP Object Injection
Photolia | Photo Company & Supply Store WordPress Theme
≤1.0.3No patch available
- Medium5.3Car Dealer, Rental & Listing WordPress theme <= 1.4.108 - Missing Authorization
Motors - Car Dealer, Rental & Listing WordPress theme
≤1.4.108No patch available
- High7.2Education WordPress Theme <= 3.4.2 - Unauthenticated Stored Cross-Site Scripting
Educavo - Education WordPress Theme
≤3.4.2No patch available
- Medium6.1Marketplace Mobile App Figma Template <= 3.3.9 - Reflected Cross-Site Scripting
Martfury - Marketplace Mobile App Figma Template
≤3.3.9No patch available
- High7.2Newspaper Magazine News BuddyPress AMP <= 7.6.7 - Unauthenticated Stored Cross-Site Scripting
Jannah - Newspaper Magazine News BuddyPress AMP
≤7.6.7Update to 7.6.8
- Medium6.6Authenticated (Shop Manager+) PHP Object Injection
YITH WooCommerce Affiliates
≤3.31.0Update to 3.31.1
- Medium4.3Missing Authorization
VillaTheme Core
≤1.0.5Update to 1.0.6
- Medium6.1Reflected Cross-Site Scripting
ThemeStek Extras for LabtechCO Theme
≤8.4No patch available
- Critical9.8Unauthenticated Arbitrary Account Takeover
SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery
≤4.0.0Update to 4.0.1